I don’t think this is strictly possible, because a custom title could be character-by-character identical to a badge granted one (possible of a badge the user doesn’t have).
Here’s a query that might do what you want:
SELECT username FROM users WHERE title IS NOT NULL AND ( SELECT count(*) FROM badges WHERE allow_title = true AND name = title ) = 0 AND ( SELECT count(*) FROM groups WHERE groups.title = users.title ) = 0
It selects every title any user has, minus every title where a corresponding badge exists, minus every title that could come from a group membership. It does not test whether the user has the badge or the group membership.
Maybe it does help you, at least as a starting point